--- title: "EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession [Final Q&A]" shortTitle: "EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession [Final Q&A]" answer_id: EBA_QA_2018_4235 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98(1) PSD2" date: 15 January 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 15 January 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4235, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-01-15" question_submitted_on: "2018-09-06" locators: published_on: "EBA Q&A register entry 2018_4235, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4235, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235)* | | | |---|---| | **Full title** | EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4235 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 15 January 2021; question submitted 6 September 2018 | | **Legal basis** | Article 98(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Ability of static card data to be considered a possession factor?** ### Question Can static card data (Card number PAN + cardholder name +Exp. Date + static CVV2/CVC2) be considered a as a possession factor, and if so: is it strong enough to be a valid factor in a 2-factor Strong customer authentication (SCA)? ### Background In its Opinion on the implementation of the RTS on SCA and CSC (EBA-Op-2018-04), the EBA explained that simple card data (Card number PAN + cardholder name +Exp. Date + CVV2/CVC2) cannot be considered a knowledge element. However, many would consider this data to rather be an element of possession, as also the physical card is an element of possession. The CVV2/CVC2 was originally intro-duced to establish that the actual physical card had at some point in time been in-volved in the initiation of the card-based payment – e.g. that it is not just a computer-generated card number under an issuer BIN. *** ### Answer Article 4(30) of Directive 2015/2366/EU (PSD2) defines ‘possession’ as “something only the user possesses”. Paragraph 28 and Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) clarified that card details and card security code that are printed on the card cannot constitute a valid possession element for the approaches currently observed on the market since the requirements of Article 7 of the Commission Delegated Regulation (EU) 2018/389 would not be met. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)